From patchwork Thu Feb 19 09:47:16 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 5850781 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: X-Original-To: patchwork-linux-sh@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id DE22ABF440 for ; Thu, 19 Feb 2015 09:47:47 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id DE3B2201B4 for ; Thu, 19 Feb 2015 09:47:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E3DA62012B for ; Thu, 19 Feb 2015 09:47:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752899AbbBSJrV (ORCPT ); Thu, 19 Feb 2015 04:47:21 -0500 Received: from albert.telenet-ops.be ([195.130.137.90]:52234 "EHLO albert.telenet-ops.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752830AbbBSJrT (ORCPT ); Thu, 19 Feb 2015 04:47:19 -0500 Received: from ayla.of.borg ([84.193.93.87]) by albert.telenet-ops.be with bizsmtp id u9nG1p01B1t5w8s069nGNt; Thu, 19 Feb 2015 10:47:17 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.82) (envelope-from ) id 1YONhU-00015q-P5; Thu, 19 Feb 2015 10:47:16 +0100 Received: from geert by ramsan with local (Exim 4.82) (envelope-from ) id 1YONhV-00032B-EO; Thu, 19 Feb 2015 10:47:17 +0100 From: Geert Uytterhoeven To: Ben Dooks , Guennadi Liakhovetski , Mauro Carvalho Chehab Cc: Sergei Shtylyov , linux-media@vger.kernel.org, linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org, Geert Uytterhoeven , stable@vger.kernel.org Subject: [PATCH v2] [media] soc-camera: Fix devm_kfree() in soc_of_bind() Date: Thu, 19 Feb 2015 10:47:16 +0100 Message-Id: <1424339236-11630-1-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 1.9.1 Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Unlike scan_async_group(), soc_of_bind() doesn't allocate its soc_camera_async_client structure using devm_kzalloc(), but has it embedded inside the soc_of_info structure. Hence on failure, it must free the whole soc_of_info structure, and not just the embedded soc_camera_async_client structure, as the latter causes a warning, and may cause slab corruption: soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at drivers/base/devres.c:887 devm_kfree+0x30/0x40() CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.19.0-shmobile-08386-g37feb0d093cb2d8e #128 Hardware name: Generic R8A7791 (Flattened Device Tree) Backtrace: [] (dump_backtrace) from [] (show_stack+0x18/0x1c) r6:c05a923b r5:00000009 r4:00000000 r3:00204140 [] (show_stack) from [] (dump_stack+0x78/0x94) [] (dump_stack) from [] (warn_slowpath_common+0x8c/0xb8) r4:00000000 r3:00000000 [] (warn_slowpath_common) from [] (warn_slowpath_null+0x24/0x2c) r8:ee7d8214 r7:ed83b810 r6:ed83bc20 r5:fffffffa r4:ed83e510 [] (warn_slowpath_null) from [] (devm_kfree+0x30/0x40) [] (devm_kfree) from [] (soc_of_bind.isra.14+0x194/0x1d4) [] (soc_of_bind.isra.14) from [] (soc_camera_host_register+0x208/0x31c) r9:00000070 r8:ee7e05d0 r7:ee153210 r6:00000000 r5:ee7e0218 r4:ed83bc20 [] (soc_camera_host_register) from [] (rcar_vin_probe+0x1f4/0x238) r8:ee153200 r7:00000008 r6:ee153210 r5:ed83bc10 r4:c066319c r3:000000c0 [] (rcar_vin_probe) from [] (platform_drv_probe+0x50/0xa0) r10:00000000 r9:c0662fa8 r8:00000000 r7:c06a3700 r6:c0662fa8 r5:ee153210 r4:00000000 [] (platform_drv_probe) from [] (driver_probe_device+0xc4/0x208) r6:c06a36f4 r5:00000000 r4:ee153210 r3:c025c2e4 [] (driver_probe_device) from [] (__driver_attach+0x70/0x94) r9:c066f9c0 r8:c0624a98 r7:c065b790 r6:c0662fa8 r5:ee153244 r4:ee153210 [] (__driver_attach) from [] (bus_for_each_dev+0x74/0x98) r6:c025b098 r5:c0662fa8 r4:00000000 r3:00000001 [] (bus_for_each_dev) from [] (driver_attach+0x20/0x28) r6:ed83c200 r5:00000000 r4:c0662fa8 [] (driver_attach) from [] (bus_add_driver+0xdc/0x1c4) [] (bus_add_driver) from [] (driver_register+0xa4/0xe8) r7:c0624a98 r6:00000000 r5:c060b010 r4:c0662fa8 [] (driver_register) from [] (__platform_driver_register+0x50/0x64) r5:c060b010 r4:ed8394c0 [] (__platform_driver_register) from [] (rcar_vin_driver_init+0x18/0x20) [] (rcar_vin_driver_init) from [] (do_one_initcall+0x108/0x1b8) [] (do_one_initcall) from [] (kernel_init_freeable+0x11c/0x1e4) r9:c066f9c0 r8:c066f9c0 r7:c062eab0 r6:c06252c4 r5:000000ad r4:00000006 [] (kernel_init_freeable) from [] (kernel_init+0x10/0xec) r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c048c3c0 r4:00000000 [] (kernel_init) from [] (ret_from_fork+0x14/0x34) r4:00000000 r3:ee04e000 ---[ end trace e3a984cc0335c8a0 ]--- rcar_vin e6ef1000.video: group probe failed: -6 Fixes: 1ddc6a6caa94e1e1 ("[media] soc_camera: add support for dt binding soc_camera drivers") Cc: stable@vger.kernel.org Signed-off-by: Geert Uytterhoeven --- Triggered with shmobile-defconfig on r8a7791/koelsch. v2: - Free info instead of removing the call to devm_kfree(), as suggested by Sergei --- drivers/media/platform/soc_camera/soc_camera.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c index cee7b56f84049944..66634b469c9899f0 100644 --- a/drivers/media/platform/soc_camera/soc_camera.c +++ b/drivers/media/platform/soc_camera/soc_camera.c @@ -1665,7 +1665,7 @@ eclkreg: eaddpdev: platform_device_put(sasc->pdev); eallocpdev: - devm_kfree(ici->v4l2_dev.dev, sasc); + devm_kfree(ici->v4l2_dev.dev, info); dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret); return ret;